Patched Zyxel GS1900 switches remain open to CVE-2026-107441 exploit
Original title: Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)
Binarly discovered the CVE-2026-107441 exploit still works on firmware fixed for a different CVE.
Zyxel GS1900 series switches received a June 2026 patch for CVE-2026-7273 but remain vulnerable to unauthenticated command execution via the real exploit CVE-2026-107441. The flaw was used to compromise nearly 1,000 devices in 48 countries. Binarly identified the exploit in malware and notified Zyxel; a fix for CVE-2026-107441 was released October 22.
Unconfirmed: The exploit is believed to be LLM-generated
- The June 2026 patch fixed CVE-2026-7273 but not CVE-2026-107441
- Exploit still achieves unauthenticated OS command execution on fixed firmware
- Patch for CVE-2026-107441 is in 2.90 Patch 3 releases
- Exploit found in malware tied to Chinese-speaking threat actor
Impact: unauthenticated OS command execution via crafted HTTP request
| Product | Affected | Fixed in |
|---|---|---|
| Zyxel GS1900 series | 2.90 Patch 2 build (XXXX.2)C0 or earlier | 2.90 Patch 3 |
- 1.Upgrade to 2.90 Patch 3 firmware
- 2.Search for evidence of compromise
- Vendors
- Zyxel
- Products
- GS1900 series
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — | ||
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
2 min read at helpnetsecurity.com
Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found. That’s because the patch fixed a different bug (CVE-2026-7273) from the one (CVE-2026-107441) the exploit actually relies on.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.